python-interpreters/python313
SHA256
7
0
Fork 0
forked from pool/python313
Code Pull Requests Activity

Add CVE-2025-8291-consistency-zip64.patch

Browse Source 
Checks consistency of the zip64 end of central directory record,
and preventing obfuscation of the payload, i.e., you scanning for
malicious content in a ZIP file with one ZIP parser (let's say a
Rust one) then unpack it in production with another (e.g., the
Python one) and get malicious content that the other parser did
not see (CVE-2025-8291, bsc#1251305)

Readjust patches while synchronizing between openSUSE and SLE trees:
  - F00251-change-user-install-location.patch
  - doc-py38-to-py36.patch
  - gh126985-mv-pyvenv.cfg2getpath.patch
This commit is contained in:
Matej Cepl
2025-11-04 17:47:42 +01:00
parent 1b4b152007
commit 02c7c3ac57
7 changed files with 398 additions and 320 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
python313.spec
View File

@@ -235,6 +235,9 @@ Patch43: bsc1243155-sphinx-non-determinism.patch
Patch44: gh138131-exclude-pycache-from-digest.patch
# PATCH-FIX-OPENSUSE gh139257-Support-docutils-0.22.patch gh#python/cpython#139257 daniel.garcia@suse.com
Patch45: gh139257-Support-docutils-0.22.patch
# PATCH-FIX-UPSTREAM CVE-2025-8291-consistency-zip64.patch bsc#1251305 mcepl@suse.com
# Check consistency of the zip64 end of central directory record
Patch46: CVE-2025-8291-consistency-zip64.patch
BuildRequires: autoconf-archive
BuildRequires: automake
BuildRequires: fdupes